The Justice Department arrested two U.S. facilitators and seized 187 laptops in a North Korean IT worker scheme that touched more than 70 U.S. employers and brought in over $3 million, SecurityWeek reports. The case moved from allegation to enforcement action on day 0, with Texas searches tied to the laptop-farm setup.
The operation worked by pairing fake or stolen identities with company-issued laptops that U.S.-based helpers kept powered on, connected, and logged in from inside the United States. To the employer, the worker looked local even when the person using the account was not, so normal location checks and device custody signals could both be faked at once.
For companies that hire remotely and ship out laptops, the exposed layer is the onboarding and identity-verification chain, not just the endpoint. The confirmed scale also shows this is a repeatable domestic proxy model: many employers can inherit persistent access from the same infrastructure, even when no single company thinks it has a one-off insider case.
Justice Department says North Koreans have infiltrated dozens of U.S. companies | TechCrunch
U.S. authorities warn that sanctioned hackers are increasingly targeting Americans to act as facilitators between breached U.S. companies and Pyongyang.